Session Fixation Risk Calculator

Rate session fixation and hijacking risk from identifier regeneration, entropy, transport acceptance, binding and timeout policy.

About Session Fixation Risk Calculator

Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly. If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.

Formulas

Session Fixation Risk

Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score).

regeneration: 1 rotated and invalidated … 9 identifier survives login
entropyScore: 1 at ≥128 bits, 9 below 32 bits

Attacker window

usable window = min(idle timeout, absolute lifetime), the minutes a stolen identifier stays valid.

idle timeout: Inactivity before the session is dropped
absolute lifetime: Hard cap regardless of activity

Worked example

With the default values below, Session Fixation Risk Calculator returns Overall Risk Severity of High. Change any input above and every figure here is recalculated in your browser.

Inputs used

Session identifier regeneration at loginone of New identifier issued and the old one invalidated — 1, New identifier issued, old one left valid — 6, Same identifier kept across authentication — 9: Same identifier kept across authentication — 9
Where session identifiers are accepted fromone of Server-set cookie only — 1, Cookie or URL parameter — 8, Any client-supplied identifier is adopted — 9: Cookie or URL parameter — 8
Session identifier entropyaccepts 16–512 bits: 64 bits
Binding to client contextone of Bound to a device signal and re-validated — 2, Bound to the IP address or user agent — 5, No binding — 9: No binding — 9
Idle timeoutaccepts 1–10,080 minutes: 60 minutes
Absolute session lifetimeaccepts 1–8,760 hours: 24 hours
Privilege carried by the sessionone of Read-only — 3, Standard user — 5, Operator — 7, Administrator — 9: Operator — 7

Results

Overall Risk Severity: High
Likelihood Score: 7.50 / 9
Impact Score: 5.67 / 9
Attacker Usable Window: 60 minutes
Identifier Entropy: Adequate, but below the 128-bit modern baseline
Highest-Value Fix: Issue a new session identifier at login and invalidate the old one

Step by step

1Values used
2Session Fixation Risk
3Attacker window
4Overall Risk Severity= High
5Likelihood Score= 7.50 / 9
6Impact Score= 5.67 / 9
7Attacker Usable Window= 60 minutes
8Identifier Entropy= Adequate, but below the 128-bit modern baseline
9Highest-Value Fix= Issue a new session identifier at login and invalidate the old one

Assumptions and limits

The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Session Fixation Risk calculated?

Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score). Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly.

Why does Session Fixation Risk matter?

If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.

What values do I need to enter?

This calculator takes 7 inputs: Session identifier regeneration at login, Where session identifiers are accepted from, Session identifier entropy, Binding to client context, Idle timeout, Absolute session lifetime, Privilege carried by the session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is binding a session to the IP address a good control?

It helps but it is not free. Mobile users change address constantly and corporate NAT puts thousands of users behind one address, so IP binding causes false logouts while barely inconveniencing an attacker on the same network. Prefer regeneration, short timeouts and a stable device signal.